Has anyone gone through Google's OAuth verification process for restricted scopes recently? They give you a choice of just two very expensive companies for security reviews.
Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
1–10 of 27 posts
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#2When we asked to use another security company for the assessment Google responded: "We understand your concern but you will have to request a security assessment from one of the following independent third-party assessors: Leviathan Security, Bishop Fox".
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#3We are in the process of going through this but have not yet received the confirmation that our scope is approved.
This process was a huge surprise for us. We are a bootstrapped startup that spent a significant amount of time building the Gmail integration last year before this was announced. We are launching shortly and have had to remove the entire integration. We have no idea how much it is going to cost or if we will be approved.
We are launching a product in a mature market with lots of competitors (hence the long initial development time), one of those being Google. According to Wikipedia, Gmail has 1.4 billion customers. I don't understand how this got past their lawyers - 1) monopoly in e-mail space, 2) create other products tightly integrated, 3) charge a $15k - $75k fee to any new competitors in your space.
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#4This seems to be new as of January 15, 2019.
https://developers.google.com/terms/api-services-user-data-p...
https://cloud.google.com/blog/products/g-suite/elevating-use...
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#5It appears to be a CYA move by google. A penetration test, clear detailed information about usage of user data, and it is done by separate contractors. I would hope they allow more contractors in the future.
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#6The practice is pretty common when dealing with a large enterprise. Pen tests vary wildly, in quality and scope. Typically, you require 3rd party pen tests, a little more common is to review the report and methodology. However, it's not uncommon to specify that it has to be a Big4 type firm or from an approved vendor list.
It's pricey, especially for small firms. However, most companies don't know what their security posture is - this is all part of managing risk.
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#7For what it's worth, Leviathan and Bishop Fox are both strong firms.
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#8We are in the process of going through this but have not yet received the confirmation that our scope is approved. This process was a huge surprise for us. We are a bootstrapped startup that spent a significant amount of time building the Gmail integration last year before this was announced. We are launching shortly and have had to remove the entire integration. We have no idea how much it is going to cost or if we…
Google isn't charging you anything in this instance; they're requiring you to get an assessment from a third party, and while $75k is way out of line for a straightforward assessment of a simple CRUD-type app, $15k is actually on the low end for that kind of work.
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#9We are in the process of going through this but have not yet received the confirmation that our scope is approved. This process was a huge surprise for us. We are a bootstrapped startup that spent a significant amount of time building the Gmail integration last year before this was announced. We are launching shortly and have had to remove the entire integration. We have no idea how much it is going to cost or if we…
Google isn't charging you anything in this instance; they're requiring you to get an assessment from a third party, and while $75k is way out of line for a straightforward assessment of a simple CRUD-type app, $15k is actually on the low end for that kind of work.
Understood, however from our cash flow perspective, Google is “charging” us this amount in order to play. We have no alternatives, we cannot find another vendor, and at the end of the day have to pay a minimum of $15k to compete with them. It makes no difference who gets the money, obviously that amount of money means nothing to Google.
Re: Ask HN: Has Google made you pay $15,000 to $75,000 for a security review?
#10Earlier quoted context omitted.
Google isn't charging you anything in this instance; they're requiring you to get an assessment from a third party, and while $75k is way out of line for a straightforward assessment of a simple CRUD-type app, $15k is actually on the low end for that kind of work.
Understood, however from our cash flow perspective, Google is “charging” us this amount in order to play. We have no alternatives, we cannot find another vendor, and at the end of the day have to pay a minimum of $15k to compete with them. It makes no difference who gets the money, obviously that amount of money means nothing to Google.
> and at the end of the day have to pay a minimum of $15k to compete with them.
From your previous statement, it seems your product is tightly integrated with gmail. That suggest you're actually relying on Google to be your infrastructure provider. If that's the case then claiming the fee is "to compete with them" is not the most accurate or honest description.